It is too bad pkgsrc from NetBSD did not become a thing, a few Linux distros allow for its use and I think Minux also uses it.
Using pkgin(1) you get to know what happens before anything is done. Creating packages is hard, but as an end user pkgsrc shows me what it will do before it does anything.
This example for installing a binary package is from an already active NetBSD workstation, all items needed will be shown for the package you want to install.
# pkgin install gnumeric-1.12.59nb2
calculating dependencies...done.
4 packages to install:
gnumeric-1.12.59nb2 goffice0.10-0.10.59nb2 lasem-0.6.0nb1 libgsf-1.14.54
0 to remove, 0 to refresh, 0 to upgrade, 4 to install
16M to download, 76M of additional disk space will be used
proceed ? [Y/n] n
How would that tell you if, say, the lasem-0.6.0nb1 package contains malware?